mcpsignals 2.0.0__tar.gz → 2.0.2__tar.gz

{mcpsignals-2.0.0 → mcpsignals-2.0.2}/.gitignore

@@ -7,3 +7,4 @@ __pycache__/
 .venv/
 .env
 .claude/worktrees
+.claude/worktrees

{mcpsignals-2.0.0 → mcpsignals-2.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpsignals
-Version: 2.0.0
+Version: 2.0.2
 Summary: Drop-in instrumentation for MCP servers. Writes tool-call events to a database you own.
 Project-URL: Homepage, https://github.com/zentered-studios/mcpsignals#readme
 Project-URL: Repository, https://github.com/zentered-studios/mcpsignals

{mcpsignals-2.0.0 → mcpsignals-2.0.2}/pyproject.toml

@@ -8,7 +8,7 @@ name = "mcpsignals"
 # stamps the real version in at release time and never commits it back, exactly
 # as packages/node/package.json is left at 0.1.0. Do not read this as the
 # published version - check PyPI or the git tags for that.
-version = "2.0.0"
+version = "2.0.2"
 description = "Drop-in instrumentation for MCP servers. Writes tool-call events to a database you own."
 readme = "README.md"
 license = "MIT"

{mcpsignals-2.0.0 → mcpsignals-2.0.2}/src/mcpsignals/intent_capture.py

@@ -13,6 +13,26 @@ from typing import Any
 
 INJECTED_KEYS = ("session_id", "agent_id", "intent")
 
+# Length caps on the three values the calling agent supplies. Without them
+# these are the only unbounded caller-controlled strings on an event, and a
+# sink that batches writes in a transaction (Cloudflare D1's `batch()`, for
+# one) loses every unrelated event in the flush when one oversized value fails
+# its statement. Capping here rather than in each sink means every sink,
+# including third-party and future ones, inherits the bound.
+#
+# `intent` is prose and takes the same 2000 as `error_message`.
+# `session_id`/`agent_id` are identifiers - a UUID is 36 chars - so they take a
+# much tighter cap. Oversized values are truncated rather than dropped: losing
+# the tail of an id is cheaper than losing the event.
+MAX_INTENT_LENGTH = 2000
+MAX_IDENTIFIER_LENGTH = 128
+
+_MAX_LENGTHS = {
+    "session_id": MAX_IDENTIFIER_LENGTH,
+    "agent_id": MAX_IDENTIFIER_LENGTH,
+    "intent": MAX_INTENT_LENGTH,
+}
+
 _INJECTED_PROPERTIES = {
     "session_id": {
         "type": "string",
@@ -49,14 +69,24 @@ def inject_schema(input_schema: dict[str, Any] | None) -> dict[str, Any]:
     return schema
 
 
+def _bounded(value: Any, max_length: int) -> str | None:
+    # A caller can send any JSON type for these keys. Anything that isn't a
+    # string can't be length-bounded, so it's dropped rather than forwarded
+    # into an event field typed `str | None`.
+    if not isinstance(value, str):
+        return None
+    return value[:max_length]
+
+
 def strip_injected(
     arguments: Mapping[str, Any] | None,
 ) -> tuple[dict[str, Any], dict[str, str | None]]:
     """Split raw arguments into (clean_arguments, extracted) where
-    `extracted` holds session_id/agent_id/intent (None if absent) and
-    `clean_arguments` has those three keys removed - exactly what the
-    handler would have received without the library.
+    `extracted` holds session_id/agent_id/intent (None if absent, non-string
+    or length-bounded per `_MAX_LENGTHS`) and `clean_arguments` has those
+    three keys removed - exactly what the handler would have received without
+    the library.
     """
     args = dict(arguments) if arguments else {}
-    extracted = {key: args.pop(key, None) for key in INJECTED_KEYS}
+    extracted = {key: _bounded(args.pop(key, None), _MAX_LENGTHS[key]) for key in INJECTED_KEYS}
     return args, extracted

{mcpsignals-2.0.0 → mcpsignals-2.0.2}/tests/test_instrument.py

@@ -7,6 +7,7 @@ from mcp.server.mcpserver.exceptions import ToolError
 from mcp.types import Implementation
 from mcpsignals import instrument
 from mcpsignals.events import ToolCallEvent
+from mcpsignals.intent_capture import MAX_IDENTIFIER_LENGTH, MAX_INTENT_LENGTH
 
 
 class RecordingSink:
@@ -217,6 +218,32 @@ async def test_intent_capture_injects_schema_and_strips_before_handler():
     assert event.intent == "user asked"
 
 
+@pytest.mark.asyncio
+async def test_intent_capture_truncates_oversized_values_before_the_sink():
+    server, sink = build_server(intent_capture=True)
+
+    @server.tool()
+    def search(query: str) -> str:
+        return query
+
+    async with Client(server) as client:
+        await client.call_tool(
+            "search",
+            {
+                "query": "mugs",
+                "session_id": "s" * 5000,
+                "agent_id": "a" * 5000,
+                "intent": "i" * 5000,
+            },
+        )
+        await asyncio.sleep(0.05)
+
+    event = sink.events[0]
+    assert event.session_id == "s" * MAX_IDENTIFIER_LENGTH
+    assert event.agent_id == "a" * MAX_IDENTIFIER_LENGTH
+    assert event.intent == "i" * MAX_INTENT_LENGTH
+
+
 @pytest.mark.asyncio
 async def test_intent_capture_per_tool_override():
     server, sink = build_server(intent_capture=False, intent_capture_tools={"search": True})

mcpsignals-2.0.2/tests/test_intent_capture.py

@@ -0,0 +1,53 @@
+from mcpsignals.intent_capture import (
+    MAX_IDENTIFIER_LENGTH,
+    MAX_INTENT_LENGTH,
+    inject_schema,
+    strip_injected,
+)
+
+
+def test_strip_injected_truncates_oversized_values():
+    _, extracted = strip_injected(
+        {
+            "query": "mugs",
+            "session_id": "s" * 5000,
+            "agent_id": "a" * 5000,
+            "intent": "i" * 5000,
+        }
+    )
+    assert extracted["session_id"] == "s" * MAX_IDENTIFIER_LENGTH
+    assert extracted["agent_id"] == "a" * MAX_IDENTIFIER_LENGTH
+    assert extracted["intent"] == "i" * MAX_INTENT_LENGTH
+
+
+def test_strip_injected_leaves_values_within_the_caps_unchanged():
+    _, extracted = strip_injected(
+        {
+            "session_id": "019609c8-1f57-7000-8000-a1b2c3d4e5f6",
+            "agent_id": "agent-1",
+            "intent": "i" * MAX_INTENT_LENGTH,
+        }
+    )
+    assert extracted["session_id"] == "019609c8-1f57-7000-8000-a1b2c3d4e5f6"
+    assert extracted["agent_id"] == "agent-1"
+    assert len(extracted["intent"]) == MAX_INTENT_LENGTH
+
+
+def test_strip_injected_discards_non_string_values():
+    # A caller can send any JSON type for these keys. Anything that isn't a
+    # string can't be length-bounded, so it's dropped rather than forwarded
+    # into an event field typed `str | None`.
+    _, extracted = strip_injected(
+        {"session_id": {"nested": "object"}, "agent_id": 42, "intent": ["a", "list"]}
+    )
+    assert extracted == {"session_id": None, "agent_id": None, "intent": None}
+
+
+def test_strip_injected_still_removes_the_keys_from_the_handler_arguments():
+    clean, _ = strip_injected({"query": "mugs", "session_id": "s" * 5000, "agent_id": 42})
+    assert clean == {"query": "mugs"}
+
+
+def test_inject_schema_is_unaffected_by_the_caps():
+    schema = inject_schema({"type": "object", "properties": {"query": {"type": "string"}}})
+    assert set(schema["properties"]) == {"query", "session_id", "agent_id", "intent"}